Yamaha NWR100 router: JVN discloses OS command injection, CVE-2026-97854
JVN discloses an OS command injection and a config file exposure in Yamaha NWR100 firmware Rev.26.00.07 and earlier, update to Rev.26.00.08.
- Published
- Ecosystem
- Network edge
- Fixed in
- NWR100 firmware Rev.26.00.08
- Exploitation
- No, the JVN advisory does not report exploitation, so exploitation is not confirmed
Live scores
CVE-2026-97854- EPSS
- 0.014
some chance of attack soon - VEDAS
- 0.061
little exploit evidence - On CISA KEV
- Not listed
- Detection rule
- No public rule yet
Live scores
CVE-2026-109822- EPSS
- 0.003
low predicted chance of attack - VEDAS
- 0.047
little exploit evidence - On CISA KEV
- Not listed
- Detection rule
- No public rule yet
What happened
On 2026-10-28, JVN, the vulnerability portal run by JPCERT/CC and IPA, disclosed two vulnerabilities in the Yamaha NWR100 wireless LAN router from Yamaha Corporation (JVN). According to JVN, the issues are:
- CVE-2026-97854, OS command injection (CWE-78). JVN says an arbitrary OS command may be executed by sending a specially crafted request to the affected product. JVN rates it CVSS 4.0 base score 9.3 and CVSS 3.1 base score 9.8. The vector shows network access with no privileges and no user interaction required (JVN).
- CVE-2026-109822, insecure storage of sensitive information (CWE-922). JVN says an unauthenticated attacker may be able to read configuration files generated by the CONFIG file export function. JVN rates it CVSS 4.0 base score 7.1 and CVSS 3.1 base score 6.5. The vector requires user interaction (JVN).
JVN credits Chuya Hayakawa of 00One, Inc. with reporting the issues to JPCERT/CC, which coordinated with Yamaha (JVN).
The following are not confirmed: exploitation in the wild, public proof-of-concept code, and any technical detail beyond the JVN advisory.
Am I affected?
According to JVN, NWR100 firmware versions Rev.26.00.07 and earlier are affected (JVN). The advisory names no other Yamaha products.
What to do now
- Update NWR100 firmware to Rev.26.00.08. JVN says Yamaha released this version to fix the vulnerabilities (JVN).
- If you cannot update right away, apply the workaround Yamaha recommends: restrict access to the Web GUI with access controls and source IP address filtering (JVN).
- Check the Yamaha vendor advisory, linked from the JVN page (Japanese only), for any further guidance (JVN).